<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I’m trying to think of whether a permissive update that allowed either the traditional way or your proposed new way would be harmful. Because that would avoid the complications of “changing” the requirement.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’ve been thinking through what might go wrong for a bit, and nothing is coming to mind. It would merely allow a CA to point to the right CPS, instead of arguably the wrong CPS. There’s the potential for some confusion during the transition
period, but that doesn’t seem to be a good argument for continuing to uniformly do it wrong.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Validation <validation-bounces@cabforum.org> <b>
On Behalf Of </b>Wayne Thayer via Validation<br>
<b>Sent:</b> Wednesday, May 18, 2022 6:20 PM<br>
<b>To:</b> CABforum3 <validation@cabforum.org><br>
<b>Subject:</b> [cabf_validation] Profiles: cPSuri for Cross-certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">While reviewing the <a href="https://github.com/sleevi/cabforum-docs/pull/36">
draft certificate profiles ballot</a>, I noticed that section 7.1.2.2.3 "Cross-Certified Subordinate CA Extensions" references
<a href="https://github.com/sleevi/cabforum-docs/blob/profiles/docs/BR.md#712105-certificate-policies">
section 7.1.2.10.5</a> for the certificatePolicies extension. This section states that the id-qt-cps (cPSuri) policy qualifier must contain:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><i>"The HTTP or HTTPS URL for the Issuing CA's Certificate Policies, Certification Practice Statement, Relying Party Agreement, or other pointer to online policy information provided by the Issuing CA."</i><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This means that the CPS link in an externally operated cross-certificate must (if present) point to the root CA's policies. I think that the cPSuri should reference the policies under which the CA certificate is operated rather than the
policies of the issuing CA.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I asked Ryan about this and he <a href="https://github.com/sleevi/cabforum-docs/pull/36#pullrequestreview-965169715">
correctly pointed out</a> that while the language is different, the same requirement exists in the current version of the BRs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This is a minor issue in the grand scheme of things, but I'd like to suggest that we consider changing the requirement, or at least add some additional language to call out the non-intuitive nature of the existing requirement.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Wayne<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>